← Sum IT Up: CMMC News Roundup
Loading summary
Transcript40 lines
- [00:00]
A
All right, folks, a lot of defense contractors are waiting to start on CMMC compliance until they see the requirement in a solicitation. The problem is that successful CMMC status is a condition of contract award. No status, no contract. If you have tons of time between solicitation and award, wonderful. But if you only have a few months between solicitation and award, waiting until solicitation is a great way to lose business. So how long did defense contractors have to achieve cmmc and when are these solicitations and awards actually happening? That's what we're going to talk about today, Jason. We're going to change up this format a little bit. We give the people what they want and we're talking about the bottom line. We're talking about the takeaways. At the start. Start, we looked at all 1070 contract opportunities that the Naval Air Systems Command anticipates over the next 12 to 24 months. Defense contractors supporting Naval air systems programs will have on Average only about nine months to prep for CMMC Level 2. If they wait until they see the requirement in a new solicitation, that is not a lot of time for the average contractor out there. Some fun facts that we're going to get into the details on. The smaller the contract, the less time you have to prepare. 35% of opportunities are anticipated to have an award window of six months or less. 30% of Nav Air solicitations are anticipated in Q2 of 2026, which is right around the corner. And 32% of their contract awards are anticipated in Q2 of 2066, which means they already put out the solicitation. So if you haven't started, you are very far behind. Initial thoughts on those, those takeaways there.
- [02:02]
B
The great and powerful macho man Randy Savage once said, the cream always rises to the top. Jacob. And right now, what I'm getting to see, because I get to speak to a lot of DIB organizations, especially lately, is that the cream is rising to the top and people are taking this seriously. And that cream is the people that are going to be able to win awards because the rest of the people that aren't necessarily the cream are having these conversations like, I haven't seen anything to make me motivated enough to do this, or I think that I could do this in enough time, or I really need your help because I scheduled my C3PAO to come in 10 days.
- [02:43]
A
Yeah. So, I mean, we've seen it anecdotally. You've seen it on your calls. I've seen it on my calls. Daniel's seen out on his calls. Everybody knows it. We've done whole episodes on analysis that the DoD has done on their own that shows that systemically DIB contractors overestimate their readiness for CMMC to a massive degree. It's always been that way. Doesn't seem to change. So that begs the question, how much time do you actually have to prepare? Because you've probably underestimated that amount of time. You have a mismatch. How are we going to be able to tell what's going on? You don't have to take our word for it. We're not trying to sell you on what we think the timeline should be. You need to find out about Procurement Administrative lead time. All right, what the heck is that? PALT Procurement Administrative Lead Time. This is an official metric that is required that the deity is required to measure it is the amount of time between a contract, solicitation and contract award. Two years ago, we did a whole episode on GAO's analysis of PALT procurement administrative lead time, tracking across the Department of Defense, Army, Navy, Air Force, everybody, they have to legally track these metrics because Congress and the Department want that window to be as small as possible, meaning they want it to be as soon as possible to go from solicitation to award. So if you're waiting until solicitation to get started on a project that might take you 12 or 18 months, those two things are not aligned. You want the defense contractor, you want the solicitation and award window to be as long as possible to prep for cmmc. Everybody else wants it to be as short as possible so they can move on and get these systems so sustained and developed and fielded, so on and so forth. This is why, in my opinion, PALT is the single most useful metric for strategically planning for cmmc. If you only have X dollars and you got Y amount of time, it better fit inside of Z pault, or else you're going to need to make some hard decisions. You're either going to need to start on CMMC before you see the requirement and a solicitation, right? You need to spend more money in order to go faster, which is not always possible for most people, or you're going to have to skip that contract entirely and go after another one later on. And most people don't want to do that, and a bunch of people can't do that. So it's very, very important that you look at the pulp window for the contract opportunities that are coming your way.
- [05:21]
B
Let's talk about the you put out some hypothetical reasons why you should get started early. Let's talk about the real reasons why that we're seeing Jacob. Right. The real reasons are start before you see a solicitation. You said that, right? What if you're not done and you're not able to see the solicitation? We see solicitations that require you to prove that you have that certification level before you get to see what's in the contract to see if you even want to bid on it. Right?
- [05:43]
A
Yeah.
- [05:44]
B
Do I want to bid on this? Is this worth my time? I don't know. I don't have the certification to see it. So we're seeing those stop gaps being put in place by industry that stops people from doing it. Makes you want to get started a little bit earlier. There's really at this point, no excuse for you not to be started.
- [05:59]
A
Yeah, absolutely. And, you know, quick caveat, right? All everything we're talking about here is prime awards from the DoD2 industry. So if you're a subcontractor to a prime, that's a whole other set of variables that you have to deal with because they can just tell you, hey, go get it. Now, you might have no idea what the pulse is, but I think you'll find that the numbers are useful even in that situation. But just be aware that if you're on the other side of a Lockheed or a Northrop or an RTX and you got another can of worms that you got to deal with anyways, let's get to something specific. Let's talk about Nav Air. Nav Air is the Naval Air Systems Command. It is the US Navy's primary organization responsible for the full life cycle support of naval aviation from research, design and acquisition to testing, training and sustainment of aircraft, weapons and systems for sailors and Marines. We're talking missiles, jets, helicopters, drones, everything it takes to design, develop, operate and sustain those platforms. All the software, all the parts, everything that the Navy does with air systems. That is a lot of stuff. That is a lot of money. That is a lot of contractors. That means that's a lot of contracts. How the heck are we going to track all of that? That is what the Long Range Acquisition forecast is for. So the lraf, sometimes known as the Long Range Acquisition, Estimates the lrae. These are projections of upcoming prime contract opportunities over the next 12 to 24 months. They typically come out every year. They are mandated to come out. These are opportunities that are going to be listed before they hit sam.gov it's mandated that they put this information out specifically for small business planning. That's great for everybody listening to this. They list the anticipated contract types, cost plus fixed price, sole source, all that stuff. All that stuff they anticipate. They list all the anticipated procurement methods, everything from full and open competition opportunities to 8 a small business set aside opportunities, everything in between. They list out whether they're single awards, whether they're purchase orders, blanket purchase agreements. Every kind of procurement instrument that Nav Air anticipates to use over the next one to two years are listed in these. They're typically spreadsheets. They also tell you if it's new work or if it's follow on work, what the contract number is, who the incumbent contractor is. Maybe that's your prime that you're a subcontractor to, which is going to be very useful here. If you're not the prime, you can find opportunities that you might be supporting as a sub. So don't tune out just yet. Check out these spreadsheets. Most importantly, the fiscal year and quarter of the anticipated solicitation and the fiscal year and quarter of the anticipated contract award. When we will see a requirement what CMMC level and when we need it by in order to take award of a contract. CMMC is a condition of contract awards. Sounds pretty useful, right?
- [09:07]
B
Yeah, sounds like something that if I were an organization looking to get a competitive advantage based off of some certification requirement that I had, I would look at this because it can allow me to pinpoint opportunities in which I might want to pursue because now I have that certification in place, right?
- [09:21]
A
Yeah, absolutely. So in December, Nav Air put out their most recent long range forecast. It had 1676 opportunities listed, everything above $700,000 all the way up to multi billion dollar contracts. This is everything from repairs, redesigns, prototypes, everything in the Nav air portfolio, C130s to freaking drones, right? Everything in total on that spreadsheet which we'll link below so you can do the numbers yourself. There's 1070 opportunities that list both an estimated solicitation date and a contract award date. The two things we need to calculate, pulse procurement, administrative lead time. Quick note on how we counted. We're being very generous here. Two things to know. We assume the absolute best case scenario, everybody, so be aware. And we counted the quarters inclusively. So first of all, best case scenario, if the Navy anticipates a solicitation in Q1 of 2026, we assume it's the first day of the quarter, not the last day of the quarter. If they anticipate awarding the contract in Q2 of 2026. We assume it's the last day of the quarter, not the first, so you get both full quarters, best case scenario. That's not always true, but we're being nice. Right. Second, we counted the quarters inclusively. So if we went from Q1 26, 2026 to Q2 of 2026, then that's 6 months, 2 quarters, not the span between the quarters as 1 quarter. Right. So Q2 of 2026 to Q2 of 2027 would be 5 quarters because we're including the first one, not 4 quarters. Right. So this is very generous best case scenario, counting. And the numbers are still pretty small.
- [11:11]
B
Totally not confusing at all. Easy to track here. And so obviously there are going to be the outliers that like something's going to be presented the last day of a quarter or whatever. But in a general case, this is a good way to go.
- [11:25]
A
Yeah, yeah. This is best case scenario. Right. So be aware as we start to jump into the numbers here. So the numbers, all nav air opportunities, all contract values, all contracts that are both considered classified and unclassified, which is a very helpful way that they break stuff down. In total, 1,070 opportunities on average. Drum roll please. 3.3 quarters from solicitation to award. That means on average 10 months to go from basically zero, which is where most people are at, to seeing the solicitation, to then being fully compliant with DFARS clause 252-204-7012 and holding a successful CMMC status resulting from a CMMC assessment in your hands, 10 months. Jason, how does that make you feel about the average chances for companies out there that are waiting for solicitation to start? Is 10 months realistic?
- [12:25]
B
Aside from the outliers where people are creating certification boundaries just to have the certification boundaries created? Right. But in situations where multiple enterprise organizations need to go through and do like, I don't know, scouring and searching for CUI within the environment and business processes and locking down data flows and things of that nature, as I've come accustomed to seeing over the past few months, I. I don't know if 10 months is realistic whatsoever. It makes me feel like that if there's a lot of organizations waiting and that's what they have lying in front of them, I don't think there's enough time. Jacob?
- [12:56]
A
Yeah, 10 months is pretty tight. 10 months is pretty tight. And we've talked about this a million times, a lot of times. It's not because of the technology. It's not because of the solution that you might be hiring us for. It's because of decisions and budgets and people, you know, deciding that this is actually a priority and getting everybody in the team to agree and all those sorts of things. Then you start talking about project kickoffs and backlogs and this and that. And all of a sudden three or four months went by.
- [13:24]
B
Exactly like I think people automatically assume, well, if I get started today, in no world, in no span are you starting right today. Your own internal procurement timeline to figure out whatever the funding is and, and to pay whatever you need to pay to get started.
- [13:40]
A
Right.
- [13:41]
B
That is going to take, like you said, a considerable amount of time. You're looking at one of the quarters there yourself. Yep.
- [13:46]
A
Less than a year. Less than a year, best case, by the way. But we crunched some more of the numbers. That's everything in the Entire spreadsheet. All 1000 plus opportunities, up to multi billion dollar opportunities. Probably not super realistic for most people. Most people listening to this podcast are probably not bidding on billion dollar contracts. So we crunch the numbers based on contract value. So all unclassified opportunities, just to make things simple. Of course, a classified contract could easily result in purchase orders and things like that that have CMMC requirements in it. But just for the sake of simplicity, we use the unclassified opportunities. So all unclassified opportunities, all contract values. Right. So if you get rid of all the classified contracts, that cuts everything in half. You're down to 550 opportunities. Average time, 3.1 quarters. That's nine months from solicitation to contract award for the unclassified contracts. That means some of the classified contracts bump that up, but only by 0.2 quarters. So a couple weeks of extra time. Most importantly, if we look at unclassified NAVAIR opportunities. Less than $2 million. Right? Less than $2 million. There's 294 of these listed in their long range forecast. On average, the period of time from solicitation to award, 2.7 quarters. Just about eight months of time from the time they say you need CMMC Level 2 certification. And if you don't have it, you're not getting this contract. We're getting smaller the smaller the contract gets, because smaller awards just don't take as long as big awards. So the smaller you are, the smaller the work that you're going after. The faster you will need to go, the more likely you will have to start on your implementation before you see the solicitation. Right, that's. That's really the catch here.
- [15:40]
B
Yeah. Jacob, eight months, I can tell you, is not realistic for 85% of the organizations that I've spoken to in the past 90 days.
- [15:48]
A
Yeah, yeah, I would agree based off of what I've seen and heard out there as well. But maybe it'll change. If you're going after bigger opportunities. You want to grow your company, you've been scaling, you've been doing all these things. Let's talk about opportunities. Two million dollars to seven and a half million dollars. There's 86 of those that Nav Air anticipates coming up on average 3.3/4 9 months from solicitation to award. I would imagine that as these awards get bigger, they get slightly more complicated. There's more data flows. There's probably more things that you got to anticipate. They're going to take longer to get ready for. They're still going to have CMMC requirements in it because those are the baseline requirements. But jumping up from less than 2 million to 2 million to 7.5 only gets you a couple extra weeks of preparation time. Doesn't actually really give you any more time. Even though the contract to you would be significantly bigger.
- [16:39]
B
It's as the opportunities decrease, I my thought process would be like smaller opportunities, more cookie cutter opportunities and the average would go down. It would have to be quicker. I can understand why there's like obviously more considerations in the larger contracts. I don't know. We're still at an opportunity. We're still at a point in time where you're talking about the opportunities in the timeline for the opportunities where I've spoken to organizations that are in position to meet this deadline within this.
- [17:06]
A
Yeah, we're still talking way less than a year. Not even close to a year. Actually. As we go through these categories of award sides, it's going to be a while before we see anything that on average is close to a year. So let's talk about things from seven and a half million to 1550 million dollars. These are getting to be pretty big awards. There's 92 of these listed in the Navair acquisition and on average 3.3/4 9 months from solicitation to award. The procurement administrative lead time. You see a solicitation, it says you need CMMC Level 2 certification. If you don't have it, you don't get the contract. You get nine months to go. Probably not enough time for most of the companies that we've talked to out there, whether they do business with us or not, because we talk to A lot of companies out there that are just trying to feel out what's going on. We're still at way less than a year, but we're up to 50 million dollar contracts.
- [17:56]
B
Yeah, as the numbers go up, the, the timeline's not going up. So again, we're beating the dead horse that doesn't matter what size the contract is, what size the organization is, or who's bidding on it. It's just the.
- [18:06]
A
Listen, let's jump, let's jump it up to the next category of contracts. 50 million to $100 million. We're bidding on $100 million worth of work.
- [18:15]
B
A lot of money.
- [18:15]
A
You better believe that this is going to be a huge priority for leadership. This isn't some hobby that people are going after. We want to win this work, we might need to win this work. This could set up the company forever. This might define whether the company makes it or not. $50 million is a lot of dollars. There's 23 opportunities in the Nav Air acquisition forecast and they have an average pulse of, you guessed it, 3.4 quarters. Call it nine and a half months from solicitation and award. We've only added a couple extra weeks and we're at 50 to 100 million dollars. We're not getting more time to get CMMC for bigger and bigger awards that are probably going to have more and more gravity and dire circumstances for not winning.
- [19:03]
B
And something that I just thought about, like you said that 50 to 100 million dollar could be like an organizational changing quantity. You could make or break your entire income.
- [19:14]
A
If a 50 million dollar contract ain't a big deal to you, you're probably not listening to this podcast, you know.
- [19:20]
B
But let's think about something else, Jacob. We just listed everything under 100 million and threshold, right? Especially like the 2 to 7.5 millions where I know multiple organizations that maybe have four or five or six of those. Right. So now you're talking about meeting that deadline at six different occurrences. Like obviously if you meet the certification once, but when, when are they going to pop up? Like when are you going to have to meet it? That's the livelihood, that's the entire livelihood of some organizations is five of those contracts with less than nine months at the time to be ready.
- [19:50]
A
Yeah, absolutely. All right. You know, they give them in the spreadsheet. So we'll talk about them. Let's talk about awards. 100 million to $250 million. If that's you. There's 15 of these opportunities that Navair Anticipates coming up here pretty soon. And good news, on average, they think it's going to be more than nine months. They give you 5.1 quarters. 15 months of anticipated time from solicitation to award. That's pretty good. Fifteen months is a decent amount of time. Sounds pretty solid. So if you would like to have a 15 month window to go from learning about CMMC requirement to holding the certification in your hand, you better be bidding on contracts that are worth 100 to 250 million bucks. Otherwise you better be able to get that done in nine months or less.
- [20:37]
B
Yeah, so it took us to get to the 100 million dollar threshold for me to get that weird butterfly feeling in my stomach that it gave me when you were like, yeah, this is the average time. This is the first timeline I feel comfortable with. If an organization came and said, hey, all of our contracts are above 100 million. Okay, well, yeah, you have some time. You don't have to freak out right now. But let's still, let's get started now.
- [20:56]
A
Right? We're dwindling in the number of opportunities here, but we're almost done. We got two more categories, everything from 250 million to a billion dollars in terms of contract opportunities. There's 11 of those. Navair is a big deal. That's a big portion of the Navy budget. There's a lot of stuff going on. $250 million to a billion dollars on these contracts. On average. We're right back to where we started. 3.8 quarters, 11 and a half months, less than a year to go from solicitation to contract award. Obviously it could be the nature of the work, could be their projection. We are not at 18 months. We are not at 24 months. We are not at two plus years of time to prep. We're talking, you might have maybe over a year if you're at 100 million, 250 million. But all of these on average are on average taking less than a year.
- [21:45]
B
We're going the other way again.
- [21:47]
A
We're going the other way now.
- [21:49]
B
I thought this number was supposed to.
- [21:50]
A
Bump up like, like we talked about in that GAO episode two years ago. Congress and the DOD don't want to have billion dol. Opportunities take years to award. They want it to get done. They want to do the business. They want that pulp window to be as small as possible. That's bad news for you if you want the Paul window to be as large as possible because the world is changing around you. Let's talk about everything over a Billion dollars. If you are going after contracts that are worth more than a billion dollars, please call us. We would love to help you. Yes, we will, we will. We will clear our calendar to take your call. There are seven opportunities listed in the Nav Air long range acquisition forecast and they on average have a Pulse Time of 5.1 quarters 15 months from solicitation to contract award. I don't know, call me crazy, but if you're working on a billion dollar project, 15 months doesn't sound like a lot of time to get everything in order because you're probably pretty big, it's probably pretty complicated. You probably got a lot going on. There's a lot of people that get to make decisions in an organization that size. So it might sound great that there's a bunch of money flowing around, but 15 months is not a lot of time.
- [23:02]
B
So the way CMMC works right now, Jacob, is, is for me as a prime contractor to accept a solicitation. Obviously I need to be certified, but I also need to keep track of all the UIDs of all the organizations in my supply chain which are going to contribute to my successful delivery of this contract. Right, Jacob? So as the prime contractor now, I'm looking at a pal Time for Navy for NavAir at 15 months, right? most if I want to go for the billion. Do you think that I'm sitting idly by with my supply chain and being like, hey guys, you have 15 months? Or do you think I'm asking them right now what you have and if they don't have it, or if I got the butterflies again in my stomach, I don't know if I'm a prime contractor. I'm putting out supply letters that say contact us if you're certified. Right?
- [23:44]
A
Also, yeah, I mean, there's that, you know, exactly like, you know, Elbit's putting out their supplier letters. Because listen, if you're putting advanced components on unmanned systems that fire precision munitions, you're probably gonna have to do CMC level two certification. They're probably not giving you CMMC level one or your customer who's the prime on that contract is almost certainly going to need CMMC level two. So it's not that big of a stretch at this point you to be like, we're going to need this. So waiting until you see it in the solicitation is really just burning a lot of time when you don't have a lot of time. So sometimes people will hear, oh, it's the phase rollout or we're in phase one. Or this or that or the it won't be fully implemented until the phased rollout is done in 2028. Forget all that. Besides the fact that all that is very squishy and not hardline policy. What type of work do you do specifically? Which contracts do you work on specifically? You can go to the long range acquisition forecasts, look up that work or those contracts specifically, and calculate how much time you will have between solicitation and award, and know exactly what kind of window you have in order to prep and get cmmc. You don't have to get sold anything, you don't have to get promised anything. You can go do the math yourself. Yeah, it's right there for everybody to get. We've been trying to bang the drum on Paul for everybody for a long time because you don't have to take our word for it. You know, you guys know better than than anybody else what kind of work you do, what contracts you do, what kind of contracts you would like to do. And it'll tell you right there in the spreadsheet when they're going to solicit it and when they're going to award it. And by the way, when you break down everything, you know, 30 to 35 of these awards are Q2 of 2026. So there's going to be a big influx of this stuff coming up. I don't know historically, if that's always Q2 is like the big time when stuff gets awarded, but if you're thinking, oh, phase two of CMMC's rollout starts in November, that means that Q2 of 2027 is going to be when a bunch of stuff is coming up for award, which means there's going to be a big influx over the next year of solicitations with CMMC level 2 level certification requirements. You're just not going to have 12, 18, 24 months to get ready. You're going to have 9, 6, 3 months depending on when you see your solicitation, when you get everybody together and decide we're going to dedicate the money and the budget to it. So don't be like everybody else. Don't overestimate your readiness. Don't underestimate how small these windows are from solicitation two award.
- [26:25]
B
Yeah, Jacob, I'm just going to say one more thing that from what I've been seeing is that like I obviously there's a lot of noise about like the DoD says it's going to require this or the DoD hasn't required CMMC and contracts because of blah, blah, blah. Right. The so you don't have that requirement, all of that noise. Right. I I'm going to tell you that everyone except for maybe one of the clients that I've spoken to in the past 90 days, their requirement, they knew that they had it. And it didn't come directly from the DoD. It came from the people that give them money to pay their bills.
- [26:55]
A
Yep. Yep. Absolutely. Lots of variables out there, but I hope the Paul idea helps everybody sort of. With some clarity on what's going on, we'll link to the Nav Air spreadsheet. Is that helpful? Do you guys think this is the right type of analysis to do? Did we miss something in the spreadsheet? We'll definitely be looking at Nav C Nav war Navs up and the rest of them coming up in the future as well. And yeah, like subscribe and we'll see you next week.
- [27:20]
B
See you next week.